After CDC (13 Oct), this post covers mutual TLS: both-sided certs, automated workload identity, mesh vs app TLS, expiry, authz on SPIFFE-like IDs, rotation overlap and trust bundles.

परस्परप्रत्ययः: A Metrical Codification of Mutual TLS (with English glosses)

What this post is about

mTLS authenticates both sides of a connection with certificates so east-west traffic carries workload identity.

Topics covered

1. Beyond network-location trust
2. Client + server certificates
3. Automated issuance (SPIFFE-class)
4. Mesh sidecar vs in-app TLS
5. Expiry monitoring
6. Identity is not authorization
7. Rotation overlap windows
8. Trust bundle distribution
9. Narrow plaintext exceptions
10. Zero-trust link

Sanskrit title

परस्परप्रत्ययः = paraspara-pratyayaḥ “mutual trust/authentication”.

English

Minimizable; Sanskrit-first.

ग्राह्यम् / Keep

१. both certs verified: client+server
२. auto rotate: short-lived workload certs
३. overlap window: accept N and N+1
४. trust bundle sync: all nodes
५. authz layer: allow by identity
६. expiry alerts: client and server
७. choose one plane: mesh or app not accidental double

त्याज्यम् / Avoid

• trust flat VPC alone
• manual yearly client certs as only process
• mTLS without authorization policy

पदच्छेदः
सेवान्तरे यदि केवलं जालविश्वासः तदा पार्श्वचोरः । परस्परप्रत्ययस्तस्माद् उभयपत्रम् ॥१॥

Word-for-word

Gloss table

English sense
Mutual TLS makes both client and server present certificates so service identity is cryptographic not just a private IP assumption.

Context / topic
Topic: why mTLS. Links to zero trust network.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
सर्वरपत्रं clientपत्रं च परीक्ष्यताम् । एकपक्षTLS अर्धसत्यम् ॥२॥

Word-for-word

Gloss table

English sense
Ordinary TLS authenticates the server to the client. mTLS also authenticates the client process to the server.

Context / topic
Topic: both sides verified.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
SPIFFE/SPIRE वर्गः identity जन्म । दीर्घmanual certs भाराः ॥३॥

Word-for-word

Gloss table

English sense
Automate workload identity issuance and rotation. Manual multi-year client certs become outage calendars.

Context / topic
Topic: automated identity. Links to cert lifecycle.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
mesh sidecar वा app TLS विवेकः । द्विदा TLS CPU दाहः ॥४॥

Word-for-word

Gloss table

English sense
Pick mesh-terminating mTLS or app-level mTLS deliberately. Doing both without need wastes CPU and confuses debugging.

Context / topic
Topic: mesh vs app TLS.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
प्रमाणपत्रचक्रः आयुं ददाति mTLS तं पथे वहति । समाप्ते पत्रे सेवा मौना ॥५॥

Word-for-word

Gloss table

English sense
Expired client or server certs fail handshakes fleet-wide. Monitoring expiry is mandatory.

Context / topic
Topic: expiry outages.

सन्धिः: पत्रचक्रः आयुः; mTLS प्रयोगः।

वृत्तमिति: एकादशाक्षराः पादाः।

पदच्छेदः
authorization still SPIFFE ID उपरि । पत्रमात्रं न RBAC ॥६॥

Word-for-word

Gloss table

English sense
mTLS proves who the caller process is. You still map that identity to allow-lists or policies for what it may do.

Context / topic
Topic: authn not authz. Links to IAM and policy-as-code.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
rotation overlap old+new accept । सहसान्त्ये विश्वभङ्गः ॥७॥

Word-for-word

Gloss table

English sense
During rotation accept previous and next cert generations for a window so rolling deploys do not deadlock handshakes.

Context / topic
Topic: rotation windows.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
private CA trust bundle सर्वत्र समः । पुराणbundle एकदेशे छिद्रम् ॥८॥

Word-for-word

Gloss table

English sense
Distribute updated trust bundles with the same care as certs. One stale trust store breaks a fraction of the mesh.

Context / topic
Topic: trust distribution.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
debug हेतु plaintext allowlist अत्यल्पम् । prod मध्ये ma plaintext ॥९॥

Word-for-word

Gloss table

English sense
If you must disable mTLS for a debug path fence it tightly. Do not leave plain east-west open in production.

Context / topic
Topic: exceptions.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
जालसीमान्यायः शून्यविश्वासं mTLS तस्य अस्त्रम् । पहिचानं पत्रे वसति ॥१०॥

Word-for-word

Gloss table

English sense
Zero-trust networking says do not trust the LAN; mTLS is a primary tool that puts identity on the wire.

Context / topic
Topic: zero-trust link (20 Jul).

सन्धिः: शून्यविश्वासः नीतिः; mTLS साधनम्।

वृत्तमिति: एकादशाक्षराः पादाः।

पदच्छेदः
उभयपत्रं auto-rotate trust authz overlap पञ्चकम् । एभिः परस्परप्रत्ययः पथसत्यसमन्वितः ॥११॥

Word-for-word

Gloss table

English sense
Five limbs: verify both sides, automate rotation, sync trust bundles, authorize on identity and overlap during rollout.

Context / topic
Topic: checklist.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
इति परस्परप्रत्ययसारः पथसत्यसमन्वितः । मितं पत्रं क्रियायोग्यं तन्त्रधर्मः स उच्यते ॥१२॥

Word-for-word

Gloss table

English sense
Closing: prove both ends of the wire then still decide what that identity may do.

Context / topic
Topic: close.

उपसंहारन्यायः: उभौ दर्शय; उभौ परीक्षस्व; काले नवीकुरु।

वृत्तमिति: ८-८-८-८।

१. Why mTLS
२. Both sides
३. Automation
४. Mesh vs app
५. Expiry
६. Authz
७. Overlap
८. Trust bundles
९. Exceptions
१०. Zero-trust
११. Five limbs
१२. Close

1. Prior: zero trust 2026-07-20; certs 2026-09-14; IAM 2026-07-21; policy 2026-08-11.
2. Domain: mutual TLS between services.
3. English minimizable; Sanskrit-first.
4. Style: no em dash; no Oxford comma in English clauses.